AndroidSystemSEPolicy

https://android-review.googlesource.com/#/c/95900/

 added
allow rules for unlabeled access as needed to all confined
domains.  Therefore we can remove it from domain.  The only
other domain that truly needs unlabeled access is init, which
presently inherits it from unconfineddomain.

Also prevent rules that would permit any confined domain from
creating new unlabeled files on the system.

Change-Id: I31c6478b42fbf60e3b7893b9578b6ad50170def6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>